The path to most GRC requirements

Editor's Notes

• #4: Remind them of the key things that we’ve all learned from the Snowden affair: If it happened to the NSA – arguably the most secure organization on the planet – it’s going to happen to you The real valuable information is the ‘distilled information’ that’s already been thought about, processed, and refined – things like executive reports, studies, intellectual property, sales forecasts, project proposals, etc. This stuff is at greatest risk by the people that touch it every day, and can either a) make an honest mistake, b) do something stupid, or c) take a malicious action The only thing that allows this to keep happening is OLD THINKING; the audience needs to use NEW TECHNOLOGY to break away from their OLD APPROACH
• #5: Organizations deal with increasing Governance, Risk and Compliance (GRC) requirements. At the heart of these GRC mandates lies the need to identify, classify and label sensitive information. RightsWATCH can classify data in accordance with your information classification mandate RightsWATCH dynamically classifies all type of information (email, documents, reports, worksheets, etc.) in accord with your organization’s predefined policies and standards. Once classified, that information can receive any markings, disclaimers, etc. that are required by statutory, regulatory, or contractual obligations. This can be done without the common user even needing to know what the policies are, much less remembering to implement them. The result is that the organization remains compliant, avoids breach and limits liability. RightsWATCH remembers, implements, and supports your company’s security requirements…even if all of the users don’t.
• #6: Watchful Software RightsWATCH digitizes your corporate classification and labeling policies to automate the process. If your policy allows, we can allow your users to override the automatic classification. RightsWATCH streamlines and simplifies the user experience. There is no impact on the end user. Unlike our competitors, there is no user input required, no time-consuming pop-up questions to answer and no judgement calls. RightsWATCH shows the user why an asset is being classified or labeled allowing him to modify the data before finalizing it. RightsWATCH automation of your policies makes your existing security infrastructure work better and faster improving compliance throughout your organization. RightsWATCH is used by a wide variety of leading companies globally. You should be using RightsWatch too.
• #7: Paul Brown, the Information Security Officer (ISO) of a financial institution in Johannesburg, is requested to make the bank’s costumer database available to John Smith, who is the headquarters’ Risk & Compliance manager. He exports the data to an Excel Spreadsheet. As the exported file comes out of the database, Paul saves it onto his desktop. The file includes PAN (Primary Account Numbers) and other PII (Personally Identifiable Information). Paul then clicks on the “New e-mail” button on MS Outlook. Next, Paul browses his desktop to attach that very same Excel Spreadsheet onto the new e-mail message. As soon as the Excel Spreadsheet is attached to the e-mail, RightsWATCH automatically classifies and RMS protects the file, without asking Paul for any decision or action on his part. RightsWATCH automatically classifies and protects this sensitive Excel Spreadsheet, according to the policy rules set up by Paul’s company. Paul then types in John’s e-mail address, but he mistypes the e-mail address and clicks on the “Send” button. Without RightsWATCH, nothing happens and the e-mail will be sent to the wrong recipient. With RightsWATCH, the email is prevented from being sent, because RightsWATCH recognises that the e-mail address that Paul typed is wrong and the recipient is not the allowed and intended recipient of the e-mail. At the same, RightsWATCH informs Paul of the fact and allows him to correct the mistype so that the e-mail can be sent to John. John receives the e-mail and opens the attached Excel Spreadsheet. He then tries to save the file onto his personal Dropbox folder, so that he can work on the file at home. RightsWATCH prevents John from saving the file onto Dropbox, by blocking him from doing so. He gets a notification on the reason why he is being prevented from doing it. He then tries to forward the email he got from Paul to his personal Gmail account. RightsWATCH prevents him from doing that also. John realizes that corporate policy dictates that sensitive files are not to be saved and shared via cloud-based drives nor are e-mails, holding corporate classified information, to be forwarded to personal e-mail accounts.
• #8: The PCI-DSS is a set of comprehensive requirements for enhancing payment account data security. to help organizations that process card payments prevent credit card fraud through increased controls around data. RightsWATCH ensures that PHI is only handled by the proper, intended users, and reduces potential liability: With RightsWATCH, a physician dealing with a patient can use email to transmit information from patient healthcare records to other appropriate parties without leading to trouble. In the same manner, a hospital might retrieve patient records from an archive and send them to an insurer as an encrypted, rights-managed document in compliance with HIPAA. To comply with ISO 27001, organizations must plan, establish, maintain, and improve an ISMS policy that includes objectives, processes, and procedures to manage risk and improve information security, including the use of classification and labeling.
• #9: RightsWATCH is uniquely capable of providing a seamless changeover to the new GSC schema as it: Can be supplied with a 'pre-made' security classification schema to ensure compliance that includes the security classifications and descriptors Allows for easily adding extra descriptors, customized tool-tip texts for each classification, or custom-configured text labels for each security classification Allows the “vanilla” classification schema to easily be modified to meet the specific needs of HMG Departments, Agencies, Local Authorities and Police Forces